feat: support private repo cloning with HTTP basic auth

- Add SSH URL detection with friendly prompt to use HTTPS instead
- Add private repo toggle (default off) with username/password fields
- Persist auth_type and credential in repositories table
- Pass stored credentials to PullRepo for authenticated pulls
- Incremental migration adds auth_type and credential columns

services/git.go

@@ -442,7 +442,8 @@ func GetBranchCommits(repoPath, branchName string, maxCommits int) ([]CommitInfo
 }
 
 // PullRepo fetches and merges latest changes from origin into the current branch.
-func PullRepo(repoPath string) (*CloneResult, error) {
+// username and password are optional; when non-empty they authenticate the pull.
+func PullRepo(repoPath, username, password string) (*CloneResult, error) {
 	repo, err := OpenRepo(repoPath)
 	if err != nil {
 		return nil, err
@@ -453,7 +454,15 @@ func PullRepo(repoPath string) (*CloneResult, error) {
 		return nil, fmt.Errorf("worktree: %w", err)
 	}
 
-	err = w.Pull(&git.PullOptions{})
+	pullOpts := &git.PullOptions{}
+	if username != "" {
+		pullOpts.Auth = &http.BasicAuth{
+			Username: username,
+			Password: password,
+		}
+	}
+
+	err = w.Pull(pullOpts)
 	if err != nil && err != git.NoErrAlreadyUpToDate {
 		return nil, fmt.Errorf("git pull: %w", err)
 	}